summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2011-10-13gpio/omap: fix build error with certain OMAP1 configsJanusz Krzysztofik
With commit f64ad1a0e21a, "gpio/omap: cleanup _set_gpio_wakeup(), remove ifdefs", access to build time conditionally omitted 'suspend_wakeup' member of the 'gpio_bank' structure has been placed unconditionally in function _set_gpio_wakeup(), which is always built. This resulted in the driver compilation broken for certain OMAP1, i.e., non-OMAP16xx, configurations. Really required or not in previously excluded cases, define this structure member unconditionally as a fix. Tested with a custom OMAP1510 only configuration. Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl> Acked-by: Kevin Hilman <khilman@ti.com> Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-10-04Merge git://github.com/davem330/netLinus Torvalds
* git://github.com/davem330/net: pch_gbe: Fixed the issue on which a network freezes pch_gbe: Fixed the issue on which PC was frozen when link was downed. make PACKET_STATISTICS getsockopt report consistently between ring and non-ring net: xen-netback: correctly restart Tx after a VM restore/migrate bonding: properly stop queuing work when requested can bcm: fix incomplete tx_setup fix RDSRDMA: Fix cleanup of rds_iw_mr_pool net: Documentation: Fix type of variables ibmveth: Fix oops on request_irq failure ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket cxgb4: Fix EEH on IBM P7IOC can bcm: fix tx_setup off-by-one errors MAINTAINERS: tehuti: Alexander Indenbaum's address bounces dp83640: reduce driver noise ptp: fix L2 event message recognition
2011-10-04Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: fix channel_remap setup (v2) drm/radeon: Set cursor x/y to 0 when x/yorigin > 0. drm/radeon: Update AVIVO cursor coordinate origin before x/yorigin calculation. drm/radeon: Simplify cursor x/yorigin calculation. drm/radeon/kms: fix cursor image off-by-one error drm/radeon/kms: Fix logic error in DP HPD handler drm/radeon/kms: add retry limits for native DP aux defer drm/radeon/kms: fix regression in DP aux defer handling
2011-10-04Merge branch 'spi/merge' of git://git.secretlab.ca/git/linux-2.6Linus Torvalds
* 'spi/merge' of git://git.secretlab.ca/git/linux-2.6: spi-topcliff-pch: Fix overrun issue spi-topcliff-pch: Add recovery processing in case FIFO overrun error occurs spi-topcliff-pch: Fix CPU read complete condition issue spi-topcliff-pch: Fix SSN Control issue spi-topcliff-pch: add tx-memory clear after complete transmitting
2011-10-04PCI: Disable MPS configuration by defaultJon Mason
Add the ability to disable PCI-E MPS turning and using the BIOS configured MPS defaults. Due to the number of issues recently discovered on some x86 chipsets, make this the default behavior. Also, add the option for peer to peer DMA MPS configuration. Peer to peer DMA is outside the scope of this patch, but MPS configuration could prevent it from working by having the MPS on one root port different than the MPS on another. To work around this, simply make the system wide MPS the smallest possible value (128B). Signed-off-by: Jon Mason <mason@myri.com> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-10-04drm/radeon/kms: fix channel_remap setup (v2)Alex Deucher
Most asics just use the hw default value which requires no explicit programming. For those that need a different value, the vbios will program it properly. As such, there's no need to program these registers explicitly in the driver. Changing MC_SHARED_CHREMAP requires a reload of all data in vram otherwise its contents will be scambled. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=40103 v2: drop now unused channel_remap functions. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-04spi-topcliff-pch: Fix overrun issueTomoya MORINAGA
We found that adding load, Rx data sometimes drops.(with DMA transfer mode) The cause is that before starting Rx-DMA processing, Tx-DMA processing starts. This causes FIFO overrun occurs. This patch fixes the issue by modifying FIFO tx-threshold and DMA descriptor size like below. Current this patch Rx-descriptor 4Byte+12Byte*341 --> 12Byte*340-4Byte-12Byte Rx-threshold (Not modified) Tx-descriptor 4Byte+12Byte*341 --> 16Byte-12Byte*340 Rx-threshold 12Byte --> 2Byte Signed-off-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-10-04spi-topcliff-pch: Add recovery processing in case FIFO overrun error occursTomoya MORINAGA
Add recovery processing in case FIFO overrun error occurs with DMA transfer mode. Signed-off-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-10-04spi-topcliff-pch: Fix CPU read complete condition issueTomoya MORINAGA
We found Rx data sometimes drops.(with non-DMA transfer mode) The cause is read complete condition is not true. This patch fixes the issue. Signed-off-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-10-04spi-topcliff-pch: Fix SSN Control issueTomoya MORINAGA
During processing 1 command/data series, SSN should keep LOW. However, currently, SSN becomes HIGH. This patch fixes the issue. Signed-off-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-10-04spi-topcliff-pch: add tx-memory clear after complete transmittingTomoya MORINAGA
Currently, in case of reading date from SPI flash, command is sent twice. The cause is that tx-memory clear processing is missing . This patch adds the tx-momory clear processing. Signed-off-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-10-03lis3: fix regression of HP DriveGuard with 8bit chipTakashi Iwai
Commit 2a7fade7e03 ("hwmon: lis3: Power on corrections") caused a regression on HP laptops with 8bit chip. Writing CTRL2_BOOT_8B bit seems clearing the BIOS setup, and no proper interrupt for DriveGuard will be triggered any more. Since the init code there is basically only for embedded devices, put a pdata check so that the problematic initialization will be skipped for hp_accel stuff. Signed-off-by: Takashi Iwai <tiwai@suse.de> Cc: Eric Piel <eric.piel@tremplin-utc.net> Cc: Samu Onkalo <samu.p.onkalo@nokia.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-10-03Merge branch 'hwmon-for-linus' of git://github.com/groeck/linuxLinus Torvalds
* 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (coretemp) Avoid leaving around dangling pointer hwmon: (coretemp) Fixup platform device ID change
2011-10-03ide-disk: Fix request requeuingBorislav Petkov
Simon Kirby reported that on his RAID setup with idedisk underneath the box OOMs after a couple of days of runtime. Running with CONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally allocates an ide_cmd struct. However, ide_requeue_and_plug() can be called more than once per request, either from the request issue or the IRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn() repeatedly, allocating a struct ide_cmd everytime and "forgetting" the previous pointer. Make sure the code reuses the old allocated chunk. Reported-and-tested-by: Simon Kirby <sim@hostway.ca> Cc: <stable@kernel.org> [ 39.x, 3.0.x ] Link: http://marc.info/?l=linux-kernel&m=131667641517919 Link: http://lkml.kernel.org/r/20110922072643.GA27232@hostway.ca Signed-off-by: Borislav Petkov <bp@alien8.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-10-03pch_gbe: Fixed the issue on which a network freezesToshiharu Okada
The pch_gbe driver has an issue which a network stops, when receiving traffic is high. In the case, The link down and up are necessary to return a network. This patch fixed this issue. Signed-off-by: Toshiharu Okada <toshiharu-linux@dsn.okisemi.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-10-03pch_gbe: Fixed the issue on which PC was frozen when link was downed.Toshiharu Okada
When a link was downed during network use, there is an issue on which PC freezes. This patch fixed this issue. Signed-off-by: Toshiharu Okada <toshiharu-linux@dsn.okisemi.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-10-03net: xen-netback: correctly restart Tx after a VM restore/migrateDavid Vrabel
If a VM is saved and restored (or migrated) the netback driver will no longer process any Tx packets from the frontend. xenvif_up() does not schedule the processing of any pending Tx requests from the front end because the carrier is off. Without this initial kick the frontend just adds Tx requests to the ring without raising an event (until the ring is full). This was caused by 47103041e91794acdbc6165da0ae288d844c820b (net: xen-netback: convert to hw_features) which reordered the calls to xenvif_up() and netif_carrier_on() in xenvif_connect(). Signed-off-by: David Vrabel <david.vrabel@citrix.com> Cc: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-10-03bonding: properly stop queuing work when requestedAndy Gospodarek
During a test where a pair of bonding interfaces using ARP monitoring were both brought up and torn down (with an rmmod) repeatedly, a panic in the timer code was noticed. I tracked this down and determined that any of the bonding functions that ran as workqueue handlers and requeued more work might not properly exit when the module was removed. There was a flag protected by the bond lock called kill_timers that is set when the interface goes down or the module is removed, but many of the functions that monitor link status now unlock the bond lock to take rtnl first. There is a chance that another CPU running the rmmod could get the lock and set kill_timers after the first check has passed. This patch does not allow any function to queue work that will make itself run unless kill_timers is not set. I also noticed while doing this work that bond_resend_igmp_join_requests did not have a check for kill_timers, so I added the needed call there as well. Signed-off-by: Andy Gospodarek <andy@greyhouse.net> Reported-by: Liang Zheng <lzheng@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-10-03drm/radeon: Set cursor x/y to 0 when x/yorigin > 0.Michel Dänzer
Apart from the obvious cleanup, this should make the line cursor_end = x - xorigin + w; correct now. Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-03drm/radeon: Update AVIVO cursor coordinate origin before x/yorigin calculation.Michel Dänzer
Fixes cursor disappearing prematurely when moving off a top/left edge which is not located at the desktop top/left edge. Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Cc: stable@kernel.org Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-03drm/radeon: Simplify cursor x/yorigin calculation.Michel Dänzer
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-03drm/radeon/kms: fix cursor image off-by-one errorNicholas Miell
The mouse cursor hotspot calculation when the cursor is partially off the top or left side of the screen was off by one. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=41158 Signed-off-by: Nicholas Miell <nmiell@gmail.com> Reviewed-by: Michel Dänzer <michel@daenzer.net> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-03drm/radeon/kms: Fix logic error in DP HPD handlerAlex Deucher
Only disable the pipe if the monitor is physically disconnected. The previous logic also disabled the pipe if the link was trained. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41248 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-03drm/radeon/kms: add retry limits for native DP aux deferAlex Deucher
The previous code could potentially loop forever. Limit the number of DP aux defer retries to 4 for native aux transactions, same as i2c over aux transactions. Noticed by: Brad Campbell <lists2009@fnarfbargle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: Brad Campbell <lists2009@fnarfbargle.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-03drm/radeon/kms: fix regression in DP aux defer handlingAlex Deucher
An incorrect ordering in the error checking code lead to DP aux defer being skipped in the aux native write path. Move the bytes transferred check (ret == 0) below the defer check. Tracked down by: Brad Campbell <brad@fnarfbargle.com> Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41121 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: Brad Campbell <brad@fnarfbargle.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-10-02Merge branch 'for-linus' of git://git.infradead.org/users/sameo/mfd-2.6Linus Torvalds
* 'for-linus' of git://git.infradead.org/users/sameo/mfd-2.6: mfd: Fix generic irq chip ack function name for jz4740-adc
2011-09-29Merge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linusLinus Torvalds
* 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus: [media] omap3isp: Fix build error in ispccdc.c [media] uvcvideo: Fix crash when linking entities [media] v4l: Make sure we hold a reference to the v4l2_device before using it [media] v4l: Fix use-after-free case in v4l2_device_release [media] uvcvideo: Set alternate setting 0 on resume if the bus has been reset [media] OMAP_VOUT: Fix build break caused by update_mode removal in DSS2
2011-09-29Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6Linus Torvalds
* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] cio: fix cio_tpi ignoring adapter interrupts [S390] gmap: always up mmap_sem properly [S390] Do not clobber personality flags on exec
2011-09-29Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~keithp/linuxLinus Torvalds
* 'drm-intel-fixes' of git://people.freedesktop.org/~keithp/linux: drm/i915: FBC off for ironlake and older, otherwise on by default drm/i915: Enable SDVO hotplug interrupts for HDMI and DVI drm/i915: Enable dither whenever display bpc < frame buffer bpc
2011-09-29ibmveth: Fix oops on request_irq failureBrian King
If request_irq fails, the ibmveth driver will overwrite the rc and end up returning a successful rc on its open function, resulting in an oops later when a packet gets sent and buffers are not allocated due to the failed open. Signed-off-by: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-29cxgb4: Fix EEH on IBM P7IOCDivy Le Ray
Fix EEH recovery on new P Series platform by requesting fundamental reset. Signed-off-by: Divy Le Ray <divy@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-29dp83640: reduce driver noiseRichard Cochran
The driver has two warning messages that might be triggered by normal use cases. When they appear, the messages give the impression of a never ending series of errors. This commit changes them to debug messages instead. Signed-off-by: Richard Cochran <richard.cochran@omicron.at> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-28Merge git://github.com/davem330/netLinus Torvalds
* git://github.com/davem330/net: ipv6-multicast: Fix memory leak in IPv6 multicast. ipv6: check return value for dst_alloc net: check return value for dst_alloc ipv6-multicast: Fix memory leak in input path. bnx2x: add missing break in bnx2x_dcbnl_get_cap bnx2x: fix WOL by enablement PME in config space bnx2x: fix hw attention handling net: fix a typo in Documentation/networking/scaling.txt ath9k: Fix a dma warning/memory leak rtlwifi: rtl8192cu: Fix unitialized struct iwlagn: fix dangling scan request batman-adv: do_bcast has to be true for broadcast packets only cfg80211: Fix validation of AKM suites iwlegacy: do not use interruptible waits iwlegacy: fix command queue timeout ath9k_hw: Fix Rx DMA stuck for AR9003 chips
2011-09-28Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6Linus Torvalds
* git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: [SCSI] 3w-9xxx: fix iommu_iova leak [SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereference [SCSI] scsi: qla4xxx needs libiscsi.o [SCSI] libsas: fix failure to revalidate domain for anything but the first expander child. [SCSI] aacraid: reset should disable MSI interrupt
2011-09-28hwmon: (coretemp) Avoid leaving around dangling pointerGuenter Roeck
Storing the struct temp_data pointer allocated from create_core_data() when returning an error has the potential of leaving around a pointer to freed memory. Reset it to NULL for error returns. Reported-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> Acked-by: Jean Delvare <khali@linux-fr.org>
2011-09-28hwmon: (coretemp) Fixup platform device ID changeJean Delvare
With recent change "hwmon: (coretemp) don't use kernel assigned CPU number as platform device ID", the microcode check is now running on random CPU. Fix that by checking the microcode before creating the platform device rather than at probe time. Also avoid calling TO_PHYS_ID(cpu) twice in the same function, it's expensive. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Jan Beulich <jbeulich@suse.com> Cc: Guenter Roeck <guenter.roeck@ericsson.com> Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
2011-09-27Merge branch 'for-davem' of git://git.infradead.org/users/linville/wirelessDavid S. Miller
2011-09-27Merge branch 'pm-fixes' of git://github.com/rjwysocki/linux-pmLinus Torvalds
* 'pm-fixes' of git://github.com/rjwysocki/linux-pm: PM / Clocks: Do not acquire a mutex under a spinlock
2011-09-27Merge branch 'master' of git://git.infradead.org/users/linville/wireless ↵John W. Linville
into for-davem
2011-09-27bnx2x: add missing break in bnx2x_dcbnl_get_capShmulik Ravid
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27bnx2x: fix WOL by enablement PME in config spaceDmitry Kravkov
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-27bnx2x: fix hw attention handlingDmitry Kravkov
Use register name to initialize attention mask Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-26Merge branch 'hwmon-for-linus' of git://github.com/groeck/linuxLinus Torvalds
* 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (coretemp) remove struct platform_data * parameter from create_core_data() hwmon: (coretemp) constify static data hwmon: (coretemp) don't use kernel assigned CPU number as platform device ID hwmon: (ds620) Fix handling of negative temperatures hwmon: (w83791d) rename prototype parameter from 'register' to 'reg' hwmon: (coretemp) Don't use threshold registers for tempX_max hwmon: (coretemp) Let the user force TjMax hwmon: (coretemp) Drop duplicate function get_pkg_tjmax
2011-09-26ath9k: Fix a dma warning/memory leakMohammed Shafi Shajakhan
proper dma_unmapping and freeing of skb's has to be done in the rx cleanup for EDMA chipsets when the device is unloaded and this also seems to address the following warning which shows up occasionally when the device is unloaded Call Trace: [<c0148cd2>] warn_slowpath_common+0x72/0xa0 [<c03b669c>] ? dma_debug_device_change+0x19c/0x200 [<c03b669c>] ? dma_debug_device_change+0x19c/0x200 [<c0148da3>] warn_slowpath_fmt+0x33/0x40 [<c03b669c>] dma_debug_device_change+0x19c/0x200 [<c0657f12>] notifier_call_chain+0x82/0xb0 [<c0171370>] __blocking_notifier_call_chain+0x60/0x90 [<c01713bf>] blocking_notifier_call_chain+0x1f/0x30 [<c044f594>] __device_release_driver+0xa4/0xc0 [<c044f647>] driver_detach+0x97/0xa0 [<c044e65c>] bus_remove_driver+0x6c/0xe0 [<c029af0b>] ? sysfs_addrm_finish+0x4b/0x60 [<c0450109>] driver_unregister+0x49/0x80 [<c0299f54>] ? sysfs_remove_file+0x14/0x20 [<c03c3ab2>] pci_unregister_driver+0x32/0x80 [<f92c2162>] ath_pci_exit+0x12/0x20 [ath9k] [<f92c8467>] ath9k_exit+0x17/0x36 [ath9k] [<c06523cd>] ? mutex_unlock+0xd/0x10 [<c018e27f>] sys_delete_module+0x13f/0x200 [<c02139bb>] ? sys_munmap+0x4b/0x60 [<c06547c5>] ? restore_all+0xf/0xf [<c0657a20>] ? spurious_fault+0xe0/0xe0 [<c01832f4>] ? trace_hardirqs_on_caller+0xf4/0x180 [<c065b863>] sysenter_do_call+0x12/0x38 ---[ end trace 16e1c1521c06bcf9 ]--- Mapped at: [<c03b7938>] debug_dma_map_page+0x48/0x120 [<f92ba3e8>] ath_rx_init+0x3f8/0x4b0 [ath9k] [<f92b5ae4>] ath9k_init_device+0x4c4/0x7b0 [ath9k] [<f92c2813>] ath_pci_probe+0x263/0x330 [ath9k] Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-26rtlwifi: rtl8192cu: Fix unitialized structLarry Finger
Driver rtl8192cu assigns a new struct rtl_tcb_desc object, but fails to clear it. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@kernel.org> [2.6.39+] Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-26iwlagn: fix dangling scan requestJohannes Berg
If iwl_scan_initiate() fails for any reason, priv->scan_request and priv->scan_vif are left dangling. This can lead to a crash later when iwl_bg_scan_completed() tries to run a pending scan request. In practice, this seems to be very rare due to the STATUS_SCANNING check earlier. That check, however, is wrong -- it should allow a scan to be queued when a reset/roc scan is going on. When a normal scan is already going on, a new one can't be issued by mac80211, so that code can be removed completely. I introduced this bug when adding off-channel support in commit 266af4c745952e9bebf687dd68af58df553cb59d. Cc: stable@kernel.org [3.0] Reported-by: Peng Yan <peng.yan@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-09-26PM / Clocks: Do not acquire a mutex under a spinlockRafael J. Wysocki
Commit b7ab83e (PM: Use spinlock instead of mutex in clock management functions) introduced a regression causing clocks_mutex to be acquired under a spinlock. This happens because pm_clk_suspend() and pm_clk_resume() call pm_clk_acquire() under pcd->lock, but pm_clk_acquire() executes clk_get() which causes clocks_mutex to be acquired. Similarly, __pm_clk_remove(), executed under pcd->lock, calls clk_put(), which also causes clocks_mutex to be acquired. To fix those problems make pm_clk_add() call pm_clk_acquire(), so that pm_clk_suspend() and pm_clk_resume() don't have to do that. Change pm_clk_remove() and pm_clk_destroy() to separate modifications of the pcd->clock_list list from the actual removal of PM clock entry objects done by __pm_clk_remove(). Reported-and-tested-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-09-26[S390] cio: fix cio_tpi ignoring adapter interruptsPeter Oberparleiter
Ensure that adapter interrupts are correctly processed when they are retrieved using TEST PENDING INTERRUPTION. Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2011-09-26[SCSI] 3w-9xxx: fix iommu_iova leakJames Bottomley
Following reports on the list, it looks like the 3e-9xxx driver will leak dma mappings every time we get a transient queueing error back from the card. This is because it maps the sg list in the routine that sends the command, but doesn't unmap again in the transient failure path (even though the command is sent back to the block layer). Fix by unmapping before returning the status. Reported-by: Chris Boot <bootc@bootc.net> Tested-by: Chris Boot <bootc@bootc.net> Acked-by: Adam Radford <aradford@gmail.com> Cc: stable@kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2011-09-26[SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereferenceNeil Horman
This oops was reported recently: d:mon> e cpu 0xd: Vector: 300 (Data Access) at [c0000000fd4c7120] pc: d00000000076f194: .t3_l2t_get+0x44/0x524 [cxgb3] lr: d000000000b02108: .init_act_open+0x150/0x3d4 [cxgb3i] sp: c0000000fd4c73a0 msr: 8000000000009032 dar: 0 dsisr: 40000000 current = 0xc0000000fd640d40 paca = 0xc00000000054ff80 pid = 5085, comm = iscsid d:mon> t [c0000000fd4c7450] d000000000b02108 .init_act_open+0x150/0x3d4 [cxgb3i] [c0000000fd4c7500] d000000000e45378 .cxgbi_ep_connect+0x784/0x8e8 [libcxgbi] [c0000000fd4c7650] d000000000db33f0 .iscsi_if_rx+0x71c/0xb18 [scsi_transport_iscsi2] [c0000000fd4c7740] c000000000370c9c .netlink_data_ready+0x40/0xa4 [c0000000fd4c77c0] c00000000036f010 .netlink_sendskb+0x4c/0x9c [c0000000fd4c7850] c000000000370c18 .netlink_sendmsg+0x358/0x39c [c0000000fd4c7950] c00000000033be24 .sock_sendmsg+0x114/0x1b8 [c0000000fd4c7b50] c00000000033d208 .sys_sendmsg+0x218/0x2ac [c0000000fd4c7d70] c00000000033f55c .sys_socketcall+0x228/0x27c [c0000000fd4c7e30] c0000000000086a4 syscall_exit+0x0/0x40 --- Exception: c01 (System Call) at 00000080da560cfc The root cause was an EEH error, which sent us down the offload_close path in the cxgb3 driver, which in turn sets cdev->l2opt to NULL, without regard for upper layer driver (like the cxgbi drivers) which might have execution contexts in the middle of its use. The result is the oops above, when t3_l2t_get attempts to dereference L2DATA(cdev)->nentries in arp_hash right after the EEH error handler sets it to NULL. The fix is to prevent the setting of the NULL pointer until after there are no further users of it. The t3cdev->l2opt pointer is now converted to be an rcu pointer and the L2DATA macro is now called under the protection of the rcu_read_lock(). When the EEH error path: t3_adapter_error->offload_close->cxgb3_offload_deactivate Is exectured, setting of that l2opt pointer to NULL, is now gated on an rcu quiescence point, preventing, allowing L2DATA callers to safely check for a NULL pointer without concern that the underlying data will be freeded before the pointer is dereferenced. This has been tested by the reporter and shown to fix the reproted oops [nhorman: fix up unitinialised variable reported by Dan Carpenter] Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Reviewed-by: Karen Xie <kxie@chelsio.com> Cc: stable@kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 05:56:50 +0000